CVE-2026-89173: Kingdom Communication Associated Smart Video Intercom System user account enumeration

CVE-2026-89173 · Severity: medium · CVSS 5.3 · Published 2026-09-11

Kingdom Communication Associated manufactures Smart Video Intercom Systems used for building entry and communication management. CVE-2026-89173 allows unauthenticated remote attackers to enumerate valid user accounts by observing differences in system responses, potentially facilitating targeted account compromise. This information disclosure can be chained with brute-force attacks to gain unauthorized access to the system.

Technologies: Kingdom Communication Associated Smart Video Intercom System EH1000B, Kingdom Communication Associated Smart Video Intercom System EH2070, Kingdom Communication Associated Smart Video Intercom System EH3040, Kingdom Communication Associated Smart Video Intercom System EH4200. Vendors: Kingdom Communication Associated.

Quick answers

Is CVE-2026-89173 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-89173 being exploited in the wild.
How severe is CVE-2026-89173?
Medium severity, with a CVSS score of 5.3, published 11 September 2026.
Which products and versions are affected?
Kingdom Communication Associated Smart Video Intercom System EH1000B before 2.7.0A; Kingdom Communication Associated Smart Video Intercom System EH2070 before 2.8.0A; Kingdom Communication Associated Smart Video Intercom System EH3040 before 2.5.0A; Kingdom Communication Associated Smart Video Intercom System EH4200 before 2.5.0A.
Is there a fix for CVE-2026-89173?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-89173 attacked?
It is attacked over the network.
Am I affected by CVE-2026-89173?
Check whether you run Kingdom Communication Associated Smart Video Intercom System EH1000B, Kingdom Communication Associated Smart Video Intercom System EH2070, Kingdom Communication Associated Smart Video Intercom System EH3040 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2026-89173 is a user account enumeration vulnerability affecting Kingdom Communication Associated Smart Video Intercom Systems. Unauthenticated remote attackers can exploit timing or response differences in the authentication mechanism to determine which user accounts exist on the system, without requiring any credentials or authentication. The vulnerability is network-reachable with no user interaction required. Enumeration of valid accounts reduces the attacker's search space and enables targeted brute-force attacks (as noted in the related CVE-2026-89174). Patches are available: update EH3040, EH4200, EH1000B, and EH2070 to versions 2.5.0A, 2.5.0A, 2.7.0A, and 2.8.0A respectively.

Affected products

  • Kingdom Communication Associated Smart Video Intercom System EH3040 before 2.5.0A
  • Kingdom Communication Associated Smart Video Intercom System EH4200 before 2.5.0A
  • Kingdom Communication Associated Smart Video Intercom System EH1000B before 2.7.0A
  • Kingdom Communication Associated Smart Video Intercom System EH2070 before 2.8.0A

Timeline

  • 2026-09-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.